What 2,000 Exposed Vibe-Coded Apps Reveal About the Limits of Most Security Stacks
A report says vibe-coded apps are exposing sensitive data and bypassing common security tools. The gap is not in one control, but in how browser-based build and publish flows are governed.
Intelligence analysis by GPT-5.4 Mini
The article says a new wave of AI-built apps is creating a bigger Shadow AI problem: employees are shipping real applications to the public internet, often linked to production systems and sometimes left open by default. It argues that traditional security stacks miss these apps because the risk lives in the browser session where the build, data connection, and publish steps all happen.
A lot of people are now using AI to make small apps very fast. The problem is that some of those apps get connected to company systems and then put on the internet where anyone can reach them.
It is like someone building a house with a magic tool, then leaving the front door unlocked and the keys under the mat. The tool is not the bad part. The missing lock is.
The story says many security tools look at the walls, the road, or the mailbox. But this new risk happens while the app is being built and published in the browser, so the company needs to watch that moment too.
Analysis
What the report found
The article describes a category-level investigation called The Shadow Builders that found more than 380,000 publicly accessible web assets across major vibe-coding platforms. Of those, about 5,000 looked corporate, and more than 2,000 reportedly contained sensitive corporate, operational, or personal data exposed on the open web. The story says many were deployed without basic access controls and, in some cases, granted admin access by default to anyone with the URL.
Why existing controls miss it
The article’s main claim is that this is not a classic Shadow IT problem. The apps are custom-built, connected directly to sanctioned systems like CRMs, ERPs, ticketing tools, and BI platforms, then published publicly from the same browser session. EDR sees ordinary browser activity. DLP can miss cloud-to-cloud API movement. CASB tends to see the platform, not the individual app. Firewall and SSE see traffic but lack the application-level context. The result is fragmented visibility across tools that each work as designed.
Where the risk lives
The article argues that the useful control point is the session layer, because the build, OAuth grant, data movement, and publish actions all happen there. That layer can tie a specific person to a specific app instance, regardless of whether the device is managed, personal, or contractor-owned. The broader message is that security stacks built around endpoints, networks, and SaaS vendors may not be enough for AI-assisted app creation.
Key points
- Red Access reportedly found more than 380,000 public web assets on leading vibe-coding platforms.
- More than 2,000 of the corporate-looking assets reportedly exposed sensitive data.
- The article says many apps were connected to production systems and published with weak or absent access controls.
- Traditional tools like EDR, DLP, CASB, firewall, and SSE can miss the full workflow.
- The article argues the browser session is the key place to control build, connect, and publish actions.
